Currently, only a handful of domestic laws directly regulate the collection and use of biometric data—such as fingerprints, voice prints, retina scans and facial scans. But that may soon change. Several state legislatures have bills pending which, if passed, would place robust requirements and limitations over private entities’ biometric practices. And many of these bills would go into effect immediately, giving covered entities little time to come in compliance before being subject to potentially significant liability.

One of those states awaiting biometric privacy legislation is Pennsylvania, which has introduced the proposed Consumer Data Privacy Act (CDPA) (H.B. 1049)—a broad consumer privacy law that encompasses the use of biometric data, much like the California Consumer Privacy Act of 2018 (CCPA). If enacted, the CDPA would directly implicate a wide swath of businesses that collect and use Pennsylvania residents’ biometric data; it would also create significant class action liability as soon as the bill is enacted.